04-06-2012
Sudo to delegate permission from non-root user to another non-root user
I've been through many threads before i decide to create a separate thread.
I can't really find the solution to my (simple) problem.
Here's what I'm trying to achieve:
As "canar" user I want to run a command, let's say "/opt/ocaml/bin/ocaml" as "duck" user.
The only to achieve this is to give "canar" user root permission in sudoers, see below:
Host_Alias LAB = linuxbox
User_Alias LABTRUSTED = canar
Cmnd_Alias LABADMIN = /bin/bash, /bin/su, /bin
LABTRUSTED LAB=(ALL) NOPASSWD: LABADMIN
And run any command:
canar@linuxbox$ sudo -i -u duck 'id'
But basically, this is a huge security hole since canar can run whatever he wants as anyone (including root)
I want to restrict canar user to be able to login as duck user (or as anyone from a given group) without providing root access
Edit: want to restrict canar user to be able to run an identified command as duck user (or as anyone from a given group) without providing root access
Any help would be welcome!
~canar
10 More Discussions You Might Find Interesting
1. Solaris
Hi
my directory not accepting any commands. its simply telling permission denied. i tried ( cp, mv, rm ) as roor
i want to set default permissons to this DIR
please find the Logs below.
dr-xr-xr-x 1 root root 1 Jun 1 09:04 AP1_ROP ( original dir)
root> chmod 777... (5 Replies)
Discussion started by: vijayq8
5 Replies
2. UNIX for Dummies Questions & Answers
hi
i am new to unix and i have abig task. i have to \run particular commands having root privileges from a non root user. i know sudo is one of the way but i need sum other approach kindly help
Thanks (5 Replies)
Discussion started by: suryashikha
5 Replies
3. Shell Programming and Scripting
I've been bashing my head on the desk for 2 days trying to get this to work, but I've had no luck. I'll try to be as clear as possible in my explanation without dragging out the details. I'm trying to set up a cron job for user "john" which runs a script. This script initiates an ssh connection to... (5 Replies)
Discussion started by: eh3civic
5 Replies
4. Shell Programming and Scripting
Hi,
I have a shell script file which is set to access permission 000. When I login as root (sudo su) and try to run this script, I am getting the Permission denied error. I have read somewhere that root admin user can execute any kind of permission script. Then why this behavior? However, I can... (1 Reply)
Discussion started by: royalibrahim
1 Replies
5. Solaris
hi guys..
how to give root permission for particular user
tel me step by step (2 Replies)
Discussion started by: coolboys
2 Replies
6. UNIX for Advanced & Expert Users
Hi!! one strange problem occurred with my RHEL 5 box.
i'm having logs folder with ownership of non-root user. Created some files with root user under logs folder.
here is the scene:
-rw-r----- 1 root root 1048227 Feb 28 12:34 SystemOut_13.02.28_12.34.10.log
-rw-r----- 1 root root ... (6 Replies)
Discussion started by: sukhdip
6 Replies
7. Shell Programming and Scripting
Currently in my system Red Hat is installed. And Many user connect to my machine via SSH Techia Terminal.
I want to give some users a root level access.
Can anyone please help me how to make it possible. I too searched on the Google but didn't find the correct way
Regards
ADI (4 Replies)
Discussion started by: adisky123
4 Replies
8. UNIX for Dummies Questions & Answers
Hi All,
I need to give an user sudo ability to root.
We have also generated RSA key but unable to proceed further.
For example after a user logs into the server normally and when he executes below command
$ssh root@server_name
This should take you to root prompt #
Please help me.... (3 Replies)
Discussion started by: Rockyc3400
3 Replies
9. Red Hat
I have a set of RHEL 5 boxes running our ERP software on Oracle databases. I need to allow my DBA's to su to oracle and one other account (banner) without knowing the oracle or banner password. But I need to prevent them from su'ing to any other user especially root. I only want them to be able to... (1 Reply)
Discussion started by: westmoreland
1 Replies
10. Solaris
Hello,
It is Solaris-10. There is a file as /opt/vpp/dom1.2/pdd/today_23. It is always generated by root, so owned by root only.
This file has to be deleted as part of application restart always and that is done by app_user and SA is always involved to do rm on that file.
Is it possible to give... (9 Replies)
Discussion started by: solaris_1977
9 Replies
LEARN ABOUT DEBIAN
csp_sucp
csp_helper(1) USER COMMANDS csp_helper(1)
NAME
csp_helper - A collection of caspar helper scripts
SYNOPSIS
csp_install dir (directory) file (file)
csp_mkdircp dir (directory) file (file)
csp_scp_keep_mode h ([user@]host) dir (directory) file (file)
csp_sucp h ([user@]host) dir (directory) file (file)
DESCRIPTION
The scripts csp_install, csp_mkdircp, csp_scp_keep_mode and csp_sucp are helpers for caspar(7). These scripts typically are not invoked
directly, but via a Makefile which uses caspar. See the notes on csp_PUSH in caspar(7) for information on how to link csp_install,
csp_scp_keep_mode and csp_sucp to caspar.
install DESCRIPTION
csp_install creates the required directory (if needed) and installs the file, preserving timestamps. It uses install(1).
install EXAMPLES
csp_INSTALL_OPTIONS='--owner=www-data --group=www-data'
csp_INSTALL_MODE=ugo=r
csp_install /srv/www index.html
csp_INSTALL_MODE=u=rwx,go= csp_install /usr/local/sbin mkpasswd
install ENVIRONMENT
csp_install honors csp_INSTALL_OPTIONS and csp_INSTALL_MODE (default is u=rw,go=r).
mkdircp DESCRIPTION
csp_mkdircp calls mkdir(1) and cp(1).
scp_keep_mode DESCRIPTION
csp_scp_keep_mode uses ssh to copy a file to a remote host, keeping its file permission mode. The trick used is a combination of mktemp(1)
and mv(1). Useful if you'd like to be sure a file gets installed e.g. group writable, without fiddling with permission bits on the remote
host.
scp_keep_mode EXAMPLE
chmod g+w rc
csp_scp_keep_mode root@gandalf /etc/uruk rc
scp_keep_mode ENVIRONMENT
csp_scp_keep_mode honors csp_SSH ("ssh" by default).
sucp DESCRIPTION
csp_sucp calls cat(1) from within sudo(1) from within ssh(1). This allows one to copy files to accounts on hosts one can only reach by call-
ing sudo on the ssh-reachable remote host.
Typically, one wants to install a root-owned file, but one does not want to allow access to the root-account directly from ssh. Typically
sudo is used as an extra line of defense.
sucp EXAMPLES
Some examples:
csp_sucp rms@bilbo /etc fstab
csp_sucp monty-python commit/ trailer.txt
sucp BUGS
If NOPASSWD is not set in the sudoers(5) file, and one's timestamp is expired, csp_sucp will forward the sudo password prompt. The given
password will be echoed on the console!
AUTHOR
Joost van Baal-Ili
SEE ALSO
caspar(7) The caspar homepage is at http://mdcc.cx/caspar/ .
csp_helper 20120514 14 mai 2012 csp_helper(1)